1

I recently set up a personal website. It contains nothing but a few pieces of information presented in a pretty way; there's no associated database or anything, it wasn't even wordpress - just hardcoded HTML and CSS with some very rudimentary javascript. Because the site was so minimal, I opted not to pay for an SSL certificate or use any sort of Malware protection. I hosted it through Hostgator with a secure, randomly generated account password and assumed that would be enough. There are probably 100 or so people who will need to look at this website over the next year or two, and after that I will probably take it down.

I made a small modification to the HTML today, and went to upload the changes. As I was doing so, I opened the site in a new tab, and saw to my horror a large banner at the top asking "Are you the account owner?" with a message allegedly from Optimum with a phone number to call and a link to click. Sadly, overwriting the index.html appears to have made the message go away and I did not have the foresight to take a screenshot before refreshing.

Now, it's possible Hostgator added that themselves and it only showed up for me, since when it showed up the favicon of the site changed to Hostgator, but this seems unlikely and I believe it was likely some sort of malware. Note however that this banner was not there 2 weeks ago and I only visited the site after logging in to my Hostgator account.

So, owning that it may have been stupid not use SSL or Malware protection, I have 3 questions:

  1. Was this Malware?
  2. If it was, then how exactly did it modify the html on my site?
  3. What's the cheapest way to prevent it from happening again?

Thanks in advance.

5
  • Why haven't you contacted Hostgator to ask if they did it?
    – schroeder
    Commented Jul 10, 2020 at 15:00
  • 1
    Because I thought they would take a while getting back to me, and I was 99% sure it had nothing to do with Hostgator, since I didn't think they had anything to do with Optimum, and as trallgorm said there was no obvious connection with a google search.
    – ThatGuy
    Commented Jul 10, 2020 at 15:21
  • If you have a compromised site or something strange on your site, you really need to contact the hosting support. They know their systems, your server, and what they might have done. You can at least be sure you can rule them out as a factor. We can't be certain about anything, not even trailgorm's answer, based solely on the info you have provided.
    – schroeder
    Commented Jul 10, 2020 at 15:52
  • I googled "Optimum injecting banners" and got this: dbstalk.com/community/index.php?threads/… and wilderssecurity.com/threads/… and dslreports.com/forum/r32133982-Web-content-injection
    – schroeder
    Commented Jul 10, 2020 at 15:56
  • @schroeder Thank you, I wound up finding similar things as well when it showed up again and I was able to google the exact wording that came up. I did try googling it before I posted this question, but only found one obscure forum post that did not convince me of anything. You are right that I should contact the ISP, but at this point I feel confident I understand what happened, and adding SSL appears to have stopped it.
    – ThatGuy
    Commented Jul 10, 2020 at 17:39

2 Answers 2

2

There's a few ways this could have happened.

  1. You're right that it could have been HostGator pushing the popup. I would contact HostGator to confirm whether or not they have done anything like that.

  2. Someone got access to your web server. They could have exploited a vulnerability in your server, guessed the FTP password, or socially engineered a HostGator employee. However given that you are mostly (I'm assuming) using new versions of off the shelf software I find this to be unlikely.

  3. It's possible that your computer is infected rather than the server. It could have been adware that you're infected with. I don't see that as likely because then you would be seeing those ads and popups everywhere rather than just your site.

  4. As @mti2935 said, it may be a MITM attack. To mitigate this install HTTPS as per his answer.

To be honest all of these seem pretty far fetched unless your website is high value. It also doesn't make sense that it would direct you to click on a link maliciously, because if they are in control of the server they could have just redirected you to the page. My guess is HostGator is responsible, although I don't understand how Optimum ties into it and a quick Google search hasn't popped up similar complaints.

5
  • Thank you. Actually, it turns out my girlfriend has been seeing similar messages randomly on her computer as well. It's very strange. We are at her mother's house. I wonder if it's a legitimate pop up caused by the ISP? Very strange.
    – ThatGuy
    Commented Jul 10, 2020 at 15:19
  • @ThatGuy seeing a screenshot would be very helpful for this. If it only happens at your mother;s house then a MITM attack is more likely (whether by the ISP or someone else). Did it only happen on your website for her? I would do a malware scan to see if theres any adware on your computer.
    – trallgorm
    Commented Jul 10, 2020 at 15:22
  • 1
    I did a malware scan on my PC and found nothing - her issues were on her computer, which I haven't touched, and she confirmed it definitely wasn't on my website. MITM sounds likely, hopefully it's just the ISP being unprofessional and not a real issue. I can't get the banner to re-appear, though if it does I will update this question with a screenshot.
    – ThatGuy
    Commented Jul 10, 2020 at 15:25
  • Does her mother use Optimum as an ISP? Did you discover this from your girlfriend after you posted? If so, that's a very significant detail to add.
    – schroeder
    Commented Jul 10, 2020 at 15:54
  • @schroeder I only found out she saw it after I posted. I would add that detail, but at this point I believe that i have all the answers I need. However, if you think it may be important to add for posterity, I will.
    – ThatGuy
    Commented Jul 10, 2020 at 17:40
2

Being that you were not connected to the site via HTTPS, there are two ways that the unexpected content that you saw could have been injected:

  1. An attacker gained access to your web server, and modified the HTML page, and injected the content there.

  2. An attacker on the network somewhere between your web server and your web browser injected the content into the HTML page that you requested 'on the fly'.

Securing your site using an SSL certificate, and allowing only https connections to your site, will eliminate the possibility of (2) happening again. This can be done very inexpensively - you can get an SSL certificate from Let's Encrypt free of charge, and mnay other CA's offer certificates for less than $10.00/year.

1
  • Thank you. I should have suspected there were free SSL certificates available. Hostgator was trying to get me to pay a lot for them, but it turns out they support Let's Encrypt free of charge. Very sneaky.
    – ThatGuy
    Commented Jul 10, 2020 at 15:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .